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The SARG04 protocol is one of the most frequently used protocol in commercial plug-and-play quantum 
key distribution (QKD) system, where an eavesdropper can completely control or change the photon number 
statistics of the QKD source. To ensure the security of SARG04 protocol in plug-and-play QKD system with an 
unknown and untrusted source, the bounds of a few statistical parameters of the source need to be monitored. An 
active or a passive source monitor schemes are proposed to verify these parameters. Furthermore, the practical 
issues due to statistical fluctuation and detection noise in the source monitoring process are quantitatively ana- 
lyzed. Our simulation results show that the passive scheme can be efficiently applied to plug-and-play system 
with SARG04 protocol. 

PACS numbers: 03.67.Dd, 03.67.Hk 



I. INTRODUCTION 

Quantum key distribution (QKD) provides a means of shar- 
ing a secret key between two parties (Alice and Bob) in 
the presence of an eavesdropper (Eve). The single-photon 
(e.g. BB84 id and SARG04 [2]), entanglement-based (e.g. 
E91 ll) and continuous variable (e.g. GG02 |4]) QKD pro- 
tocols have proved to be unconditionally secure under ideal 
(source, channel, detection and postprocessing) assumptions 
II5I- U2I1 . In practical QKD systems, the security assumptions 
are not completely satisfied and security loopholes exist | IS*]. 
Real implementations of QKD may deviate from the ideal 
models in security proofs, such as laser with intensity fluc- 
tuation 11141 Qj ll, detectors with mismatched detection effi- 
ciency III6I421I1 , or detection blinding |22-24]. The uncon- 
ditional security of practical QKD systems will be compro- 
mised if these loopholes are not included in general security 
analysis or no counter measures are made. For instance, the 
ideal security proof for the BB84 protocol was given when a 
single-photon source was assumed |6], while highly attenu- 
ated laser source is often used in real experiment, where the 
source sometimes produces multi-photon states. Due to the 
channel loss and these multi-photon states. Eve can perform 
the photon-number-splitting (PNS) attack lf25ll . Lately, more 
general security analysis for the BB84 protocol with weak 
coherent laser source and semi-realistic models were given 
jHIK]. Furthermore, several methods (such as decoy state ||26| - 
and SARG04 |2] protocols) have been proposed to fight 
against the multi-photon loophole. 

The security loophole considered in this paper is the un- 
trusted source problem lf33l - l43ll . In the standard security 
analysis of some protocols (such as BB84, decoy state, and 
SARG04 protocols), the photon number distribution (PND) 
of the QKD source is assumed to be fixed and known to Alice 
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and Bob, which is defined as a trusted source. However, in a 
one-way QKD system, the intensity fluctuation from the laser 
source and the parameter fluctuation from the optical devices 
cause the assumption of the trusted source to fail ifTil [T5II42I1 . 
More seriously in a two-way plug-and-play QKD system. Eve 
can even control or change the PND of the QKD source in 
principle, such that the source is unknown and untrusted ifssll . 
To solve the untrusted source problem, the statistical charac- 
teristics of the QKD source need to be monitored in real ex- 
periment ll36ll . Many theoretical researches have been done on 
the security analysis for BB84 and decoy state protocols with 
an untrusted source lf35l[37l - l4lll43ll . and the real-time source 
monitoring for both one-way and two-way systems have been 
demonstrated experimentally 13^ [37i |42|] . 

As is pointed out in jst], the SARG04 protocol is more ro- 
bust than BB84 against the PNS attack, and has been applied 
in commercial plug-and-play QKD system |44]. However, 
this protocol also suffer from the untrusted-source problem. 
In this paper, rigorous security analysis for the SARG04 pro- 
tocol with an untrusted source is given, and the lower bound 
of secure key rate is devised if the ranges of a few statistical 
parameters of the untrusted source are known. Then, an active 
and a passive schemes are proposed to monitor these param- 
eters. Furthermore, the practical issues of finite data size and 
detection noise are quantitatively analyzed. 



n. SECURITY ANALYSIS FOR THE SARG04 PROTOCOL 
WITH AN UNTRUSTED SOURCE 

The security key rate of the SARG04 protocol is 1^ 
R = -Q^f(E^)H2(E^) + Qi[l-H2(Zi\Xi)] 

+ Q2[l - H2(Z2\X2)l (1) 

where Qf^ and Ef^ are the total count rate and quantum bit error 
rate (QBER) respectively, Q\(2) is the gain of the l(2)-photon 
state, Zi(2) and Xi(2) are random variables characterizing the 
phase and bit errors for the 1 (2)-photon state respectively, f(x) 



2 



is the error correction efficiency, and H2{x) - -xlog2(jc)-(l - 
x) log2(l - x) is the Shannon entropy function. Suppose px\{2) 
denote the probabiHty that bit flip without phase flip occurs on 
l(2)-photon state, pzui) denote the probabiHty that phase flip 
without bit flip occurs on l(2)-photon state, and Py\(2) denote 
the probability that both bit flip and phase flip occur on 1(2)- 
photon state. Let e,- (gp,) denote the bit (phase) error rate for 
/-photon state, andei(2) = pxn2}+PY\(2),epH2) = Pz\{1\+Pyi(2)- 
It has been proved for one-way postprocessing that [|9t]. 



Px\ = ei - fl, Pz\ = ~ -f ''1 ^ 

Px2 - e2-b, pz2 < xe2 + g(x) -b, pY2-b, (2) 

where g{x) = [3 - 2x -H (6 - 6 V2x + Ax^f^^]l6, and ei/2 < 
a < e\, < b < 62- Based on Eq. (|2]i, one has H2{Zi\X\) < 
i/2™''(Zi 1^1 X where i/2™'''(Zi 1^1 ) = -H2{ei)-e,\og2{e\)-{\- 
2ei)log2(l 



2ei), and H2{Z2\X2) < i/2(Z2) < //2(e°f ), where 



e^'^ - m2Lx{xe2 + g{x)}. Then, 



R > -Q^.m^)H2{E,) + Q,{\-H-^^\Z,\Xi)-\ 
+Q2[1 - H2(ep]. 



(3) 



In order to calculate the final secure key rate, one needs a good 
estimation of Qi(2) and eia)- There are a few methods to ap- 
proach the target. One is proposed by GLLP |8], where all 
the losses and errors are assumed from the 1 -photon and 2- 
photon states, and 2i(2) and eira are overestimated. Another 
is the decoy state method ll26l432ll . which can accurately esti- 
mate the parameters. Here, we consider the SARG04 protocol 
combined with decoy state method. 

A fundamental assumption in the decoy state protocol with 
a trusted source is e„ - e;' = ef, and Y„ - F,^ - ll26ll . 
where Y„ is the yield of n-photon state and the superscript 
s{d) means the signal (decoy) source. The optimal estimation, 
with applying infinite decoy states, converges to 



Y„ = r]„(^ + ^) + ^{1 - T]„)Yo, 



(4) 



probability for Alice to send out l(2)-photon state that is fixed 
and known to Alice and Bob with a trusted source. 

In the untrusted source case, the assumptions of e;' = e'^ 
and y,J - are broken HEll, and the results in Eq. Q 
no longer hold. One needs new methods to estimate Q\(2), 
which has been an open question. Fortunately, the results 
in fi3j3^ provide two new ways to estimate the lower bound 
of Q\ for BB84 protocol combined with 3-intensity decoy 
state methods. However, in SARG04 protocol, both 1 -photon 
and 2-photon states have positive contributions to the secure 
key rate. Thus, the main task for the SARG04 protocol with 
an untrusted source is to derive the lower bound of Qa- We 
find a modification of the method in L39i1 will approach this 
task. In the following, the lower bound of Q2 is calculated for 
the SARG04 protocol combined with 4-intensity decoy state 
method in untrusted source scheme. 

In a SARG04 protocol combined with 4-intensity decoy 
state method, Alice randomly sends four kinds of sources: 
vacuum, decoy- 1, decoy-2 and signal source, with probabil- 
ity pq. Pi, P2, and p', respectively. In the trusted source 
scheme, the source is controlled completely by Alice, and 
the quantum states of vacuum, decoy- 1, decoy-2 and signal 
sources are expected to be po = |0) {0|, pi = 2,^o I") ^"1' 
P2 = Zr=o |n) <n| and p, = 2,T=o K l«) <«l' respectively, 
where {a'„, a„, bn] are fixed and known. In the untrusted 
source scheme, the source is controlled and prepared by Eve 
(as shown in Fig.lTfa)), and {a'„, a„, b„] are unknown. 

Suppose Alice sends M optical pulses to Bob totally. In 
a real experiment, one could observe the following parame- 
ters: Ns, Nd\{2), and A^o (the number of counts caused by sig- 
nal, decoy- 1(2), and vacuum sources, respectively). Then the 
count rates for signal, decoy- 1(2), and vacuum sources are 
Qti = NJp'M, Qdu2) = Ndi(2)/pi(2)M, and Fq = No/poM, 
respectively. Denote the lower (upper) bound of {a^, a„, b„] 
as {fl,',^*^', an^^\ b^^^^}. One can rigorously prove that (see 
Appendix A for details) 



(5) 



under condition 



where 77,, is the probability for «-photon state to arrive at Bob's 
detector, Yq is the dark count rate of Bob's detector, and ejet 
is the probability that a photon hit the erroneous detector in 
Bob's side. Then, one has Qi(2) - Pi{2)Yi(2), where f i(2) is the 



^>^>^, (forallk>3). 



and 



(6) 



Q2 > 



^3 iidl ~ iifi ~ (<^2 ~ 3 ^ ~ ^ 3 I ~ 1 3 ^ 



b'r 



(7) 



under conditions and 



When one consider the contribution from only 1 -photon 
state for the SARG04 protocol, the final secure key rate is 

Riphown > -Q,f(E^,)H2(Ef,) + ei[l - H^'\Zi\Xi)]. (10) 

The parameters {flg^, a^, a'^, a^, a'^ , a^) need to be verified 
to estimate the gain of 1 -photon state in Eq. (|5]), after which 
one has e\ < E^^Q^^j Q\. Then one can calculate the secure key 
rate as Eq. ( fTOl i. This case is defined as Case-1. When one 
consider the contributions from both 1 -photon and 2-photon 
states, the parameters {a[^, b^, a^, a!^, h\, a^, a'^, b!^, a^, 
a'-^ , need to be verified to estimate the gains of 1-photon 
and 2-photon states as in Eqs. Q and (|7]i. Then one can nu- 
merically choose the optimal values e\ and under constrain 
Q^lE^^ > Q\e\ + Q^e^ to lower bound the secure key rate in 
Eq. (O. This case is defined as Case-2. Note that the condi- 
tions in Eq. (|6]) for case-1 and in Eqs. ([8]l and (|9]l for case-2 
need to be verified experimentally. In the following, we pro- 
pose an active and a passive source monitors to estimate these 
statistical parameters experimentally. 

III. ACTIVE AND PASSIVE SOURCE MONITORS 

The schematic diagram of a QKD system with an untrusted 
source is shown in Fig.llla), where the source is assumed to be 
completely controlled and prepared by Eve. A source monitor 
is used to verify the statistical characteristics of the untrusted 
source in Alice's side. At least two schemes can realize the 
source monitor: an active scheme shown in Fig. [Ttb) ifisll . 
and a passive scheme shown in Fig. [He) fi^^^l^. Suppose 
that P\{n) is the PND of the untrusted source at PI (?/ means 
position / in Fig.[TJ, and P-iim, rj) is the PND at P3 given that 
the attenuation coefficient of the VOA is Then one has ll36ll 

P3{m, rj) = P,{n) ( " ) - ir"\ (11) 

Z — i«-m \ ill I 

where rj' = rj for active scheme and rj' = rj x tjbs for passive 
scheme. Due to the definition of {fl'„, «„, fe„,), 

= P3(m,T]s), a„ = Pi(m,T]di), b,n = P3('«,'7rf2)- (12) 

A full security analysis procedure can be divided in to four 
steps. Stepl: Estimate the bounded statistical parameters 
of the untrusted source based on the experimental measure- 
ment results. Step2: Verify the conditions shown in Eqs. ^ 
and (|9l). Step3: Calculate the lower bound of Q\ and Q2 based 
on Eqs. Q and (Q. Step4: Estimate the final secure key rate. 

A. Active Source Monitor 

In the active source monitor shown in Fig. [TJb); one half 
of the optical pulses are randomly sent to a photon-number- 
resolving (PNR) detector for parameters estimation, and the 
other half are sent to Bob for key generation |35]. For simpli- 
fication, the PNR detector is assumed to be noiseless and the 
detection efficiency is 1 . Clearly, 
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FIG. 1: (Color online) (a) Schematic diagram of the QKD system 
with an untrusted source. The untrusted source prepared at PI by 
Eve, where Pi means position / (i = 1,2,3,4,5), passes through an 
optical filter, a phase randomizer (PR), an encoder and a variable op- 
tical attenuator (VOA) with attenuation coefficient = rjs, tj^u rjdi, 
and 0, for the signal, decoy- 1, decoy-2, and vacuum source, respec- 
tively. Then, the source is sent into a source monitor at P2 to esti- 
mate the statistical parameters for security analysis, and sent out of 
Alice's side at P3. (b) Schematic diagram of an active source mon- 
itor. A high-speed active optical-switch (OS) randomly sends one 
half of the input optical pulses to a photon-number-resolving (PNR) 
detector at P4 for parameter estimation, and sends the other half to 
Bob for key generation, (c) Schematic diagram of a passive source 
monitor. The optical pulses are passively separated into two parts 
by a beam-splitter (BS) with transmittance 7/35 : one goes to a PNR 
detector with efficiency r]o at P5, which is modeled by an attenua- 
tor with efficiency rjo combined with an ideal PNR detector, and the 
other is sent out of the source monitor. 

where D(m, 77) is the probability that m photoelectrons are 
recorded by the PNR detector given that the attenuation co- 
efficient of the VOA is 77. Combining the results in Eqs. ( fT2b 
and ([nil, a'„, - D{m,i]s),a„, - D(m,T]di),b,„ - D(m,T]d2)- 
Clearly, one can bound of parameters {a'„^,a,„,bm] based on 
the recorded data D{m, iff. Then one can verify the conditions 
in Eqs. (|6]l, ([8]l, and and calculate the final secure key rate. 

B. Passive Source Monitor 

As pointed out in | l36l[37|] . it is challenging and inefficient 
to implement the active scheme. Then, a practical passive 
scheme is proposed and tested experimentally lf36|] . In the 
passive source monitor shown in Fig. [Tfc), optical pulses are 
separated into two parts by a beam splitter (BS) with transmit- 
tance riBs'- one goes to a PNR detector with efficiency rjo, and 
the other is sent out of Alice's side. For simplification, one set 

{I - r]Bs)r]D = r]BS- (14) 

Then the PND at P3 is the same to that at P5, 

P5(m,i])^P3(m,i]). (15) 

If the PNR detector is noiseless, the detected photoelectron 
distribution F(m, rf) at P5 will be the same to Psim, rj). 



D{m,ri) ^ Pi{m,r]), (m = 0, 1, 2, 3, ■ ■ ■), (13) 



F{m, rj) — Psim, rj). 



(16) 
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Based on Eqs. ( fT2] i. ( fTsT i and ( fTSI l, one can bound the pa- 
rameters fl,„, with the knowledge of F(m, rf). In a real 
system, one needs to consider the practical imperfections of 
the source monitor. In the following, the effects of statistical 
fluctuation and detection noise are quantitatively analyzed. 



1. Infinite Data Size and Noiseless Source Monitor 

Suppose that M is the total number of optical pulses sent 
from Alice to Bob, while p'M(- M,), p\M{- M\), and 
P2M - (M2) is the number of signal, decoy- 1, and decoy-2 
pulses, correspondingly. 

Stepl. When the data size M ^ 00, one has a'J" - a'„^ - 
F(m,r],), a^, = = F(m,7]di), b^, = b^, = F{m,r]d2)- 

Stepl. The conditions in Eqs. ([S) and (|9]l turn to 



F{k,^^,) ^ F(3,7],) 



F(2,77,) ^ F{l,jj,) 



Fik,i]di) ~ Fi3,T]di) ~ Fi2,r]di) ~ F{l,T]ai) 
F(3, m)F(h%) - F(l,i]di)F(3, J],) Fjl, 77^2) 
F(2, r]di)F(3, T],) - F(3, i]di)F(2, 7;,) F(2, ijdi) 



(k > 4), 



1 + 



> 0. 



Step3. In case-1, the gain of 1 -photon state is calculated by 
Eq. ^ based on the recorded data F(m, if), and all the errors 
are assumed from 1-photon state ei = EfjQ^IQi. In case-2, 
the gains of 1-photon and 2-photon states are calculated by 
Eqs. (|5]) and (|7]) based on the recorded data F{m, rj), and ei(2) 
are chosen numerically to lower bound the secure key rate. 

Step4. Calculate the secure key rate for case-1 and case-2 
with Eqs. ( fTOl i and (O, respectively. 

For testing the efficiency of the passive scheme, the sim- 
ulation results for the trusted source are compared with that 
for the untrusted source (shown in Fig.|2|, while the data size 
is infinite. The PND for the trusted and the untrusted source 
is assumed to be of Poissonian statistics to perform simula- 
tions. The error correction efficiency f{E^) - 1.22. The 
transmittance rjEs of the BS is 0.13 and the detection effi- 
ciency rja of the PNR detector is 0.15. The other experi- 
mental parameters are cited from the GYS experiment ll45ll 
as shown in Table U where rjBoh is the efficiency of Bob's 
detection, eg is the probability that a dark count hit the er- 
roneous detector in Bob's side. Suppose the average photon 
number (APN) for signal, decoy- 1 and decoy-2 sources are 
II, v\ and V2, respectively. The conditions in Eqs. ([8]l and (|9]l 
- " '1^ > ^ > 4^ > JZ^ for all k > 4, and 



turn to -^TTT- > -^T7^ > -^ttS- > ■ 
1 - T^-^ > 0. As shown in Fig. |2l the performance of 
the untrusted source based on the passive source monitor is 
very close to that of the trusted source, and the 2-photon state 
makes positive contribution to the secure key rate. 



TABLE I: The simulation parameters for Figs. 12151 
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FIG. 2: (Color online) Simulation results of the SARG04 protocol 
for the trusted source, compared with the untrusted source in both 
case-1 and case-2 when the data size is infinite. In the trusted source 
case, infinite decoy state method is used to estimate the values of 
2i, 22. ei, ^2 as in Eq. ([4j. The top (red) line is the simulation results 
for the trusted source, where one considers the contribution from 
both 1-photon and 2-photon states. The second (yellow) line is the 
simulation results for the untrusted source in case-2. The third (blue) 
line is the simulation results for the trusted source, where one con- 
siders the contribution from only 1-photon state. The bottom (green) 
line is the simulation results for the untrusted source in case-1. In 
all the simulations, the PND for both trusted and untrusted source is 
assumed to be of Poissonian statistics. 



2. Finite Data Size and Noiseless Source Monitor 

Suppose that the data size M is finite. Let j;^, fj^, and yff 
denote the number of detected signal, decoy- 1 and decoy-2 
pulses at P5 given the PNR detector records m photoelectrons. 

Stepl. The APN of signal source is ju ~ (9(10 ') while 
the APN of decoy- 1 source is vi ~ (9(10^^). When the data 
size is finite (e.g. M - 10^^), one may always observe that 
j'^ = for aU m > 7 while jf > (e.g. J - 10) in a real 
experiment, which infers that the counts caused by the photon 
number states m > 7 in decoy- 1 source can be ignored in the 
experiment. For instance, given that the PND of the decoy- 1 
source is Poissonian with an APN vi = 0.01, the probabil- 
ity that the decoy- 1 source sends out photon number states 
n > 10 is less than 10"^^, which can be ignored for data size 
M - 10'^. To estimate Qi and Q2, and verify the conditions 
in Eqs. (|6]l, ([8]), and (|9]l, one only needs to bound the param- 
eters {fl'„^, b^} for m - 0, 1, ■ ■ ■ , 7 and n - 0, 1, 2 with 
finite data size (see Appendix B). Using the random sampling 
theory |46], each F(m,ris) € [j'n/Ms - s'JlJMs + s'] with 
a confidence level 1-2 exp(-Ms£'^/2) for signal pulses, and 



eiichFim,T]n2))e[ji"-^^/Mn2)- 



•ei(2),;m*^VMi(2)-Hei(2)] with 



a confidence level 1 - 2 exp(-Mi(2)£jpj/2) for decoy-l(2) 
pulses can be estimated. Simultaneously, F(m, 775) e [j^^/Ms- 
s',jJM,+s'], F(m,7]i) e [ji^/Mi -sufjm form = 
0, 1, 2, ■ ■ ■ , 7, and F(n, 772) e [;f /M2-e2, jf/M2+S2] for n = 
0, 1 , 2 are approximately estimated with a confidence level 
a = 1 - 2(7 -F 1) exp(-M,e'V2) - 2(7 + 1) exp(-MieiV2) - 
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FIG. 3: (Color online) Simulation results for the SARG04 protocol 
with an untrusted source in case-1 and case-2 with data size M, based 
on the passive source monitor. The PND of the untrusted source is 
assumed to be Poissonian. The other experimental parameters are 
cited from Table |l] (a) Simulation results in case-2 with data size 
M = oo, 10'^, 10", 10'", 10', respectively, (b) Simulation results in 
case-1 with data size M = oo, 10'^ 10", 10'", lO', respectively. The 
confidence level is set to be 1 - 10"*. 
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FIG. 4: (Color online) Comparison between case-1 and case-2 for the 
SARG04 protocol with an untrusted source: (a) with data size M = 
10'^; (b) with data size M = 10". The PND of the untrusted source 
is assumed to be Poissonian. The other experimental parameters are 
cited from TableU The confidence level is set to be 1 - 10"*. 



Ml 



M2 



■ Si, 



for m - Q,\,2, - ■ ■ , J and n = 0,1,2 with confidence level a. 

Step2. It is challenging to verify directly the condition 
in Eq. ([S) with finite data size: a) In hardware, the PNR de- 
tector is required to discriminate the photon number n - 
0, 1, ■ ■ ■ , oo; b) When the photoelectron number m is large 
enough, one always gets fc^, = ^Jj'/ - 0. One needs a rea- 
sonable cutoff value of m. Suppose fj - for all m > J 
while > 0. To lower bound the gains of Qi and Q2 with 
finite data size, one can replace the condition in Eq. (|8]l as 



a:^ a'J- a'^ a'.^ 

^ > ^ > 4^ > ^, (foralU < k < J), 



(17) 



where the PNR detector is only required to discriminate pho- 
ton number n = 0, 1, ■ ■ ■ ,7 (see Appendix B for details). The 
condition in Eq. (|9]l turns to 



^ ^ F(3,;7^i)F(l,?7,)-F(l,?7rfi)F(3,?7,)F(2,?7^2) , 
F(l, ridx)F{X ri,) - F(3, mi)F{2, tj,) F(2, r^i) 



(18) 



Step3. If the conditions in step2 are satisfied, one can lower 
bound the parameters Q[ and 22- 

Step4. Calculate the secure key rate for case-1 and case-2 
with Eqs. (fTOl i and (|3]l, respectively. 

For testing the effects of finite data size, we choose an un- 
trusted source of Poissonian statistics to perform simulations 
in both case-1 and case-2. The error coiTection efficiency 
f{Efj) are chosen to be 1.22. The other experimental param- 
eters are cited from Table I. Simulation results for case-2 and 
case-1 are shown in Fig. 13 a) and (b), and the data size are set 
to be M = 00, 10'^ 10", 10'" and lO**, respectively. To com- 
pare the two cases more clearly. Fig. |4] shows the simulation 
results for case-1 and case-2 with M - 10'^ and 10", respec- 
tively. In all the above simulations, the confidence level is set 
to be a = 1 - 10"^. The simulation results show that statisti- 
cal fluctuation has negative effect on performance of the QKD 
system. When the data size is large enough, the 2-photon state 
has positive contribution to the secure key rate. 



3. Finite Data Size and Source Monitor with Random Additive 
Detection Noise 

Given a PNR detector with an independent additive detec- 
tion noise y, the detected photoelectron number in', and the 
photon number m at P5 satisfy m' - m+y. One can calculate 
the lower and upper bound of PND Ps(m, rf) at P5 based on 
the photoelectron distribution F{m, rf) with a high confidence 
level, given that the distribution of the detection noise N{y) is 
known by Alice. 

The dark count is the main kind of detection noise for the 
PNR detector such as time multiplexing detector (TMD) ll48l 
49], transition-edge sensor (TES) B50fl . or a threshold detector 
together with a VOA |51]. In case of independent Poisson 
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statistics noise, the probability of detecting m' photoelectrons 
is F(m',rf) = T^lLo^^y = - d)Ps{d,j]) where N{y ^ d) ^ 
e^'^A'' ld\ is the probabiHty that d dark counts occur in the PNR 
detector, and A is the average dark-count rate. Then, one has 



^P5(0,7,) 
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Stepl. Using random sampling theory i4€S\ . simultane- 
ously, F(m,T],) e [j'„/M, - s'J'^/Ms + s'], F{m,r]di) e 
[jiliM, - eiJi'/Mi + fill, and F(m,i^d2) e [jf/M2 - 
£2, jf'IM2 + £2] for m = 0, 1, 2, ■ ■ ■ , 7 and n = 0, 1, 2 are es- 
timated with a confidence level 1 - 2(7 + 1) exp(-M5e'^/2) - 
2(7 + 1) exp(-Miei V2) - 6 exp(-M2e2V2). Then, one yields 
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FIG. 5: (Color online) Simulation results for the SARG04 protocol 
with an untrusted source based on the passive scheme: (a) with finite 
data size M = 10'", and the average dark count rate of the Poisso- 
nian detection noise A = 0, 10^^,0.5, and 1, respectively, in case-2; 
(b) with finite data size M = 10'^, and the average dark count rate of 
the Poissonian detection noise A = 0, 10"*, 1, 1.5, and 2, respectively, 
in case- 1 . The PND of the untrusted source and the distribution of de- 
tection noise are assumed to be Poissonian. The other experimental 
parameters are cited from Table |l] The confidence level is 1 - 10"*. 



Step3. Lower bound the parameters Qi and 22- 
Step4. Calculate the secure key rate for case-1 and case-2 
with Eqs. (fTOl i and (|3]l, respectively. 

For testing the effect of dark count noise, the simulation 
results for case-2 are shown in Fig.|5ja), with finite data size 
M - 10'~ and average dark count rate A = 0, 10"'', 0.5, and 
1, respectively. The simulation results for case-1 are shown 
in Fig.Hb) with M = 10'^ and A = 0, 10"^ 1, 1.5 and 2, 
respectively. The confidence level is set to be a = 1 - 10"^. 



IV. SUMMARY AND CONCLUSION REMARK 



^ A/ Jm=0 

2^^ M, 



+ £'). 



Our analysis is not limited to the Poissonian noise case. Gen- 
erally, when the random-positive detection noise y with dis- 
tribution A^(y) is known to Alice, one can still use the same 
method in Ii43il to estimate the parameters {aq^, b^, a^, a'^, 
b\, a^, a'^, b2, a^, 03^, a^) with a certain confidence level. 

Step2. Using the same method, one can estimate the bound 
values {a'l^^, a^] for 4- < k < J, and verify the conditions in 
Eqs. (|9]l and (fTTj i. Since the expressions of {a^^, a^] for 4 < 
^ < 7 are much complex and trivial, we assume the above 
conditions are satisfied as in IBo, 14011. 



In summary, we have shown the unconditional security of 
the SARG04 protocol with an untrusted source, given that 
the bound of some key statistical parameters of the untrusted 
source are known by Alice and Bob. The analytical expression 
for the lower bound of the gain of 2-photon state is derived. 
Furthermore, an active and a passive source monitors are pro- 
posed to verify these parameters experimentally. Finally, we 
analyze the effects of the practical imperfections in the passive 
source monitor quantitatively, such as finite data size and ad- 
ditive detection noise. Asymptotically, the performance of the 
QKD system with an untrusted source combined with passive 
source monitor is very close to that of a trusted source. Our 
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results can be directly applied to plug-and-play QKD system 
with SARG04 protocol. 
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Appendix A: Lower bound of Q[ and Q2 for SARG04 Protocol 
with an untrusted source 



Suppose Alice sends M pulses to Bob in the whole quan- 
tum process. At any time /, where ; 6 {1,2, ■■■,M), 
Alice randomly produces vacuum (|0)(0|), decoy-1 (pu - 
Zr=o I") ^"D' decoy-2 (p2/ = 2," „ b„i \n) <n|), and signal 
(Psi = Iir=o "ni I") source with the probabiUty po, pi, p2, 
and p', respectively, where {«„,, b„i, a'^^ are controlled and 
prepared by Eve. Following the methods in ||39[ l40ll . some 
definitions are necessary for further analysis. Definition 1. In 
the protocol, Alice sends M pulses, and Bob gets M observa- 
tions. If Bob's detector click at time /, we say that "the /th 
pulse from Alice has caused a count". Definition 2. Sets C 
and c„: Set C contains any pulse that has caused a count; set 
c„ contains any «-photon pulse that has caused a count. Defi- 
nition 3. Denote the lower (upper) bound of {a' ., fl„,-, b„i} as 

Define dki 



for / = 1,2,- - ■ ,M. 
' and Di 



pulse contains zero photon, the probability that it comes from 
the vacuum source is f ,,,|o - podot. Therefore, the number 
of counts caused by vacuum source is A^o - Hieco Pvi\o - 
Zfeco Podoi- Similarly, if the /th pulse contains zero photon, 
the probability that it comes from the decoy-1, decoy-2 and 
signal source are fi/|o = piaoidoi, P2i\o - piboidoi, and 
^'.!/|o - p'aQidoi, respectively. Then the number of counts 
caused by zero photon state in decoy-1, decoy-2 and signal 
source are norfi = Ii,£e„ Piflo/t/o/, "0^2 = Zieco Piboidoi, and 
no.! = Yjieco P'^^'oidoi, respectively. It is clear that 



Pxo.'^Nq 

PO 



pia^No 



PO 



PO 

p'a'o"N(, 

PO 



> nod2 > 



PO 



nos 



p'a'o'-No 

PO 



'Od\' 



'Or 



(Al) 



The main result in 113911 is to derive the lower bound of Di 
based on 3-intensity decoy state method (which can be seen 
as a special case of the 4-intensity decoy state method p2 = 
in this paper). 



D, > D 



—Ndi - -^Ns - ^n'^., + ^nfr 

p\ p P\ Od\ p' Os 

„'L ,.iL ^ JL 2 1 



(A2) 



under condition > 4r > -tt for all ^ > 3. Further, one 

fl^ (7, (7j 

can lower bound the gain of 1 -photon state in signal source, 

gi = p' 2 <=^'uduyM - shown in Eq. ©. In the 

following, the lower bound of Q2 is derived. The number of 
counts caused by decoy- 1 (2) and signal sources are 



nodi 



■ pi ^ audu + Pi ^ a2;'^2i + /'i "'^''^i''' 



k=3 ieci 



nodi + /'2 ^ budii + P2 ^ ^2;'^2; + /'z ^ ^ bkida. 



k=3 iecf; 



k=3 iecif 



(A3) 



which can be rewritten as 



Ndi ^nodi+ Pia^Di+ pia!^D2+ piAi-^i, (A4) 
Nd2 = nod2 + P2b\Dx + P2^2^2 + Pi^i + ^1, (A5) 
= no, + p'a[^Di + /^'oj^Da + p'A' + ^3, (A6) 



where Al = Xt^a^D^, A2 = llZ^biDk, A' = Y^Z^^'k^'Dk, 
and ^1 > 0, ^2 > 0, ^3 > 0. Define 

^ = A'-fl^^/fl^Ai, 



and assume %r > %r > %r ^ -ir for all k > A, which leads 
to ^ > 0, one has 



Ns = + p'a'i^£>i + p'a2^£>2 + p'^Ai + p'^ + ^3. (A7) 
Combining Eqs. (IA4I > and ( |A7| >, one has 



'^Ndi - "fNs - '^nodi + 'fnos + (a^a'^"- - a'^'a^D, + + ^(^3 + p'O 



D2 = 



Since ^1, ^3 and ^ are all non-negative, a'^^a^ - a^a'^ > 



and flj^fl^ - fl^fl'j^ > 0, one has 



p\ '-'^ p' p\ (Ml 0.9 ^ 3 1 3 1-' 



D2 > 



(A8) 
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It is clear that Ndi > n^^^ + p2b'^Di + p2^2^2- Then one has 



pib' 



(A9) 



decoy- 1 source, which can be explained as the probability that 
Alice produces a fc-photon pulse in decoy- 1 source and the 
pulse causes a count at Bob's detectors. Clearly, 2^ ' ^ and 
Qd\ < HLo Qf + 2r=y+i which infers. 



Combine the results of Eqs. ( IA8I ) and ( IA9I ), one has 



pi p' pi Odl p' \)s ' 3 



■ a, a. ) TT — 

3 1 ' p2l?\ 



under conditions 



(AlO) 
for all A: > 4 and 



1 + ]lIu_}jJl ^ > 0. Further, one can estimate the lower 



bound of gain of 2-photon state in signal source Qi > ^ 
as shown in Eq. (|7|. 



where fy - ^^7= 'dO.'^k- Using the Clopper-Pearson confidence 
interval theory [47'], one can upper bound Pj with a confi- 
dence level 1 - a, where (1 - P^)*^' = a/2 and Pj~^is 
the upper bound of P j. Similar to Eqs. (IA3b . one has 



n: 



^:-3 /Gc^- 



Appendix B: Verify the condition in Equation © in finite data 

size 



ieci /GC2 /:— 3 iec^ 



Suppose that one observe jf,' = for all m > J while j^' > 
0, and 7,', = for all m > J' while jj, > (J' > J) in a real 
experiment. Similar to Eqs. ( IA3b . 

J oo 
il:=0 k=J+l 

where Qdi - Nd\ IM\ is the count rates of the decoy- 1 source, 
and Qj^ - pi Yjiect '^kidnlMi is the gain of ^-photon state in 



where A^'^j - Nd\ - M\P^ . Then one can calculate the lower 
bounds of D\ and D2 can be expressed the same as Eqs. ( IA2I) 
and dAlOl ) except replacing the Nd\ by A^^j, and the condition 
in Eq. ([8]) can be replaced by 

\>\>\>\, (forall4<k<J). 

fl^ flj flj 
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